🦾Biomedical Engineering I Unit 9 Review

Quality control refers to the techniques, activities, and procedures used to make sure a product meets its quality requirements. In medical device development, quality control isn't something you tack on at the end. It needs to be woven into every stage, from early design and prototyping through manufacturing and post-market surveillance.

Design controls are a particularly important piece of this. These are the quality practices built directly into the design and development process to ensure the final device meets user needs, intended uses, and specified requirements. Design controls include several interconnected activities:

Design planning — mapping out the development process
Design input — defining the requirements the device must meet
Design output — the deliverables (drawings, specs, software) that result from design work
Design review — formal checkpoints where the team evaluates progress
Design verification — confirming the design output meets the design input requirements
Design validation — confirming the finished device actually meets user needs under real conditions
Design transfer — handing off the validated design to manufacturing
Design changes — managing any modifications after the design is established

Process validation is the other major quality pillar. It involves collecting and evaluating data from process design through commercial production to establish scientific evidence that a manufacturing process consistently delivers quality products. The word "consistently" matters here: a process that works sometimes isn't validated.

Statistical methods for quality control

Two statistical approaches show up frequently in device manufacturing:

Statistical process control (SPC) uses statistical methods to monitor a process in real time and keep it operating within acceptable limits. The goal is to catch variation before it produces nonconforming products. Common SPC tools include:

Control charts (tracking process output over time)
Cause-and-effect (fishbone) diagrams
Pareto charts (identifying the most significant sources of defects)
Histograms, scatter diagrams, check sheets, and flow charts

Acceptance sampling takes a different approach. Instead of monitoring the process continuously, you randomly inspect a sample from a batch or lot and use the results to decide whether the entire batch meets acceptance criteria. This is useful when 100% inspection isn't practical, but it does carry the risk of accepting a batch that contains some defective units.

Risks of medical device use

Categorizing risks associated with medical devices

Risk, in the context of medical devices, is defined as the combination of the probability of occurrence of harm and the severity of that harm. A low-probability event that could kill a patient is still a serious risk. A high-probability event with trivial consequences may be less concerning.

Risks associated with medical devices generally fall into three categories:

Design risks — problems inherent to the device's design, such as biocompatibility issues, software failures, or mechanical malfunctions
Manufacturing risks — problems introduced during production, such as contamination, inconsistent quality between batches, or packaging defects
Use risks — problems arising from how the device is actually used, including user errors, off-label use, and inadequate maintenance

Separating risks into these categories helps you target the right mitigation strategy. A design risk requires a design change; a use risk might be addressed through better labeling or training.

Tools for identifying and assessing risks

Risk analysis follows a systematic process: identify hazards, estimate the probability and severity of each risk, and then determine whether each risk is acceptable.

Two widely used tools for this analysis:

Failure Mode and Effects Analysis (FMEA) is a proactive, bottom-up approach. You go through each component or process step and ask: What could fail here? What would cause that failure? What would the effect be? Each failure mode gets scored for severity, probability of occurrence, and detectability. The product of those scores (the Risk Priority Number, or RPN) helps you prioritize which failures to address first.

Fault Tree Analysis (FTA) works in the opposite direction. It's a top-down, deductive technique. You start with an undesired event (e.g., "device delivers incorrect dose") and work backward through a logic diagram to identify all the potential causes and combinations of causes that could lead to that event.

Risk mitigation for patient safety

Implementing risk control measures

Once risks are identified and assessed, risk mitigation means putting controls in place to reduce either the probability of harm or its severity. Risk control measures follow a hierarchy, applied in order of preference:

Inherent safety by design — Eliminate or reduce the risk through the device design itself. This is the most effective approach. Examples: selecting biocompatible materials, incorporating fail-safe mechanisms, simplifying the user interface to prevent errors.
Protective measures — Add features or devices that protect against risks that can't be designed out. Examples: safety guards, alarms, automatic shutoffs, backup systems.
Information for safety — Provide labeling, instructions for use, warnings, and user training. This is the least reliable layer because it depends on the user actually reading and following the information.

You may also see this hierarchy expressed using the broader occupational safety framework: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. The principle is the same: design-level controls are always preferred over relying on human behavior.

Evaluating residual risks and post-market surveillance

Even after applying risk controls, some level of risk usually remains. Residual risk is what's left over, and it needs to be evaluated through a risk-benefit analysis. This compares the remaining risk against the clinical benefits the device provides. If the benefits outweigh the residual risks, the device can move forward. If not, additional controls or a design change may be needed.

Post-market surveillance picks up where pre-market risk management leaves off. Once a device is on the market, manufacturers must monitor its real-world safety and performance. This serves two purposes:

Identifying risks that weren't apparent during development (rare failure modes, unexpected use patterns)
Providing ongoing feedback that drives continuous improvement of the device and its risk management processes

Quality management system compliance

Quality management system standards for medical devices

A quality management system (QMS) is the documented framework of processes, procedures, and responsibilities an organization uses to achieve its quality objectives. For medical devices, two major standards define what a QMS must include:

ISO 13485 is the international standard for medical device QMS. It specifies requirements for organizations to demonstrate they can consistently provide devices and related services that meet customer and regulatory requirements. ISO 13485 is based on ISO 9001 (the general quality management standard) but adds requirements specific to medical devices, including risk management integration, design controls, and regulatory compliance documentation.

FDA Quality System Regulation (QSR), codified as 21 CFR Part 820, establishes current good manufacturing practice (CGMP) requirements for medical devices sold in the United States. It covers the methods, facilities, and controls used in design, manufacture, packaging, labeling, storage, installation, and servicing of finished devices intended for human use. If you're developing a device for the U.S. market, compliance with 21 CFR Part 820 is mandatory.

These two standards overlap significantly, but they aren't identical. Manufacturers selling internationally often need to satisfy both.

Auditing and regulatory compliance

Audits verify that a QMS is actually working as documented. There are two types:

Internal audits are conducted by the organization itself to assess whether its QMS is effectively implemented and maintained. Think of these as self-checks.
External audits are conducted by third parties, such as certification bodies or regulatory agencies. These provide independent verification of QMS effectiveness and regulatory compliance.

The Medical Device Single Audit Program (MDSAP) was created to reduce the burden of multiple external audits. Under MDSAP, a single audit by an authorized auditing organization can satisfy the regulatory requirements of five participating jurisdictions: the United States, Canada, Brazil, Australia, and Japan. Without MDSAP, a manufacturer selling in all five markets might face five separate audits covering largely the same ground.

🦾Biomedical Engineering I Unit 9 Review